chore(deps): patch critical & runtime security advisories - #1356
Open
zhigang1992 wants to merge 10 commits into
Open
chore(deps): patch critical & runtime security advisories#1356zhigang1992 wants to merge 10 commits into
zhigang1992 wants to merge 10 commits into
Conversation
Close 3 critical advisories that ship in the browser bundle via the
crypto-browserify polyfill by pinning patched leaf versions, plus bump
direct runtime dependencies to clear 7 moderate advisories. Sentry held
at latest v8 (8.55.2) to avoid the breaking v8->v10 major.
- resolutions: cipher-base >=1.0.7, pbkdf2 >=3.1.6, sha.js >=2.4.12
- axios 1.11.0 -> 1.18.0
- @sentry/{browser,core,types} 8.24.0 -> 8.55.2
- sanitize-html 2.11.0 -> 2.17.5
- @aws-sdk/client-s3 3.826.0 -> 3.1068.0
- lodash-es 4.17.21 -> 4.18.1
- ws (desktop) 8.18.0 -> 8.21.0
Audit: 4 critical/25 moderate -> 1 critical (dev-only shell-quote)/18.
Verified: yarn install + build:packages (pre-existing UserScriptEditor
test type errors unaffected). All bumps stay within current majors.
@sentry/types' User type is deprecated as of the 8.55 bump (no-deprecated lint error). The type moved to @sentry/core.
Bump 37 direct dependencies across all workspaces to their latest same-major versions. Verified with `yarn install`, `yarn build:packages` (no new TS errors vs baseline) and `yarn test` (1408/1408 runnable tests pass; the pre-existing `?raw`-import ENOENT suite-load failures and the two Editor.test.tsx type errors are unchanged from main). Notable bumps: webpack 5.97->5.107, posthog-js 1.205->1.386, react-hook-form 7.58->7.79, ramda 0.29->0.32, react-use 17.4->17.6, zustand 5.0.8->5.0.14, electron-builder/app-builder-lib 26.0->26.15, semver 7.5->7.8, plus @types/*, mcap, fluentui, dayjs, and others. Deliberately held back (same-major but type/behavior-breaking; would require product-code changes): - chart.js 4.4.7 -> 4.5.1 (Point types now allow null) - @types/three 0.166 -> 0.184 (null-ness + texture generics) - @tanstack/react-table 8.11 -> 8.21 (ColumnDef typing) - ts-essentials 10.0.4 -> 10.2.1 (DeepPartial "excessively deep") - @types/moment-duration-format 2.2.6 -> 2.2.7 (stale ts-expect-error) - idb 8.0.0 -> 8.0.3 / idb-keyval 6.2.1 -> 6.2.5 (IndexedDbMessageStore tests) Also held: prettier (repo-wide reformat), @foxglove/ws-protocol 0.1->0.8, and all 55 true major-version bumps (React 19, MUI 9, Storybook 10, Electron 42, TypeScript 6, eslint 10, etc.).
zhigang1992
force-pushed
the
sleepy-liskov-bd2724
branch
from
June 16, 2026 01:12
d51df10 to
0021dd2
Compare
The same-major bump to posthog-js 1.386.8 throws repeated uncaught runtime errors against coScene's self-hosted PostHog: TypeError: this._surveyManager.getActiveMatchingSurveys is not a function at posthog-js/dist/module.js (surveys) The self-hosted PostHog server's surveys.js targets the older client's internal API; the newer client renamed/moved _surveyManager methods, so surveys polling crashes on a loop. Caught by running the app against a live (volc) backend — build and jest pass because nothing exercises PostHog surveys against the real server. Production runs 1.205.0, so pin to match the deployed server until PostHog server-side is upgraded.
asn1.js (pulled in via the crypto-browserify browser-crypto chain) does
`try { require("vm") } catch {}` as a Node-only fast path. Add `vm: false`
to resolve.fallback so webpack treats it as intentionally absent in the
browser bundle instead of emitting a build warning on every compile.
# Conflicts: # package.json # packages/studio-base/package.json # yarn.lock
# Conflicts: # packages/studio-base/package.json # packages/studio-web/package.json # yarn.lock
# Conflicts: # packages/studio-base/package.json # yarn.lock
# Conflicts: # package.json # packages/studio-base/package.json # yarn.lock
# Conflicts: # package.json # packages/studio-base/package.json # packages/studio-desktop/package.json # yarn.lock
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
修复安全告警:pin 浏览器产物中的 critical 传递依赖(cipher-base/pbkdf2/sha.js),升级 axios、Sentry 等运行时依赖;影响线上的 critical 从 4 归零(仅剩 1 个 dev-only),无行为变更。